Improved Strongly Deniable Authenticated Key Exchanges for Secure Messaging

Abstract

A deniable authenticated key exchange (DAKE) protocol establishes a secure channel without producing cryptographic evidence of communication. A DAKE offers strong deniability if transcripts provide no evidence even if long-term key material is compromised (offline deniability) and no outsider can obtain evidence even when interactively colluding with an insider (online deniability). Unfortunately, existing strongly deniable DAKEs have not been adopted by secure messaging tools due to security and deployability weaknesses. In this work, we propose three new strongly deniable key exchange protocols-DAKEZ, ZDH, and XZDHthat are designed to be used in modern secure messaging applications while eliminating the weaknesses of previous approaches. DAKEZ offers strong deniability in synchronous network environments, while ZDH and XZDH can be used to construct asynchronous secure messaging systems with offline and partial online deniability. DAKEZ and XZDH provide forward secrecy against active adversaries, and all three protocols can provide forward secrecy against future quantum adversaries while remaining classically secure if attacks against quantumresistant cryptosystems are found. We seek to reduce barriers to adoption by describing our protocols from a practitioner's perspective, including complete algebraic specifications, cryptographic primitive recommendations, and prototype implementations. We evaluate concrete instantiations of our DAKEs and show that they are the most efficient strongly deniable schemes; with all of our classical security guarantees, our exchanges require only 1 ms of CPU time on a typical desktop computer and at most 464 bytes of data transmission. Our constructions are nearly as efficient as key exchanges with weaker deniability, such as the ones used by the popular OTR and Signal protocols.

Post-quantum Asynchronous Deniable Key Exchange and the Signal Handshake

“…Unger and Goldberg [82,83] also consider deniable authenticated key exchange (DAKE) protocols for secure messaging. Their protocol permits the optional use of a PQ KEM for ephemeral key exchange to achieve forward secrecy against future-quantum adversaries.…”

“…There are several prior works giving definitions of offline deniability for key exchange [24,25,31,82,83]. Our definition differs from previous ones in that it gives access to secret keys to the Fake algorithm (corresponding to the simulator in simulation-based definitions) and to the adversary (i.e., the judge).…”

“…Prior work defined several notions of offline deniability for authenticated key exchange [24,25,31,82,83]. Based on the work of Dwork, Naor, and Sahai [37] on deniable authentication, Di Raimondo, Gennaro, and Krawczyk defined concurrently deniable (or fully deniable) authenticated key exchange using the simulation paradigm in [31].…”

Identity-based Deniable Authenticated Encryption for E-voting Systems

“…Their scheme shows high efficiency in the light of comprehensive performance evaluation. Recently, many related protocols [24,25,26,27] have been presented. Jin et al [24] proposed a DAE scheme, and their construction is applicable for e-voting systems.…”

“…Jin et al [24] proposed a DAE scheme, and their construction is applicable for e-voting systems. Unger and Goldberg [25] proposed three deniable authenticated key exchange protocols. These three protocols can support forward secrecy against future quantum adversaries.…”